chore: refactor re-usable workflows to enable re-use in derived repositories (#968)

* ci: refactor wc-build-push for better re-use

* chore: make runner labels configurable

* chore: decouple flavor from wc-build-push-test

* chore: fix issues with image name

* chore: fix duplicate env

* chore: fix more duplicate env's

* chore: fix findings

* chore: start with fixing integration tests

* chore: split-off image name sanitization

* chore: fix path to integration tests

* chore: enable docker credentials for integration test

* ci: change secret names

* ci: enable multiple labels for single runner selection

* ci: try to fix syntax for fromJson

* ci: try to fix runner selection

* ci: handle devcontainer metadata properly

* ci: don't escape '='

* ci: fix linter feedback

* ci: fix more runs-on

* chore: retry merge-image in bash

* ci: various fixes and improvements

* ci: fix document upload for release

* ci: integrate changes from main

* ci: more refactoring

* ci: fix cancellation and metadata label

* ci: fix cancellation

* ci: refactor to multiple re-usable layers

* ci: fix internal scenario

* ci: fix permissions

* ci: fix issues with secrets and refactor further

* ci: fix permissions

* ci: suppress invalid linter finding

* ci: make acceptance test secrest optional

* chore: refactor copilot instructions

* ci: block network access when not required

* ci: add acceptance tests and reduce duplication

* ci: fix release build

* ci: add requirement and change some naming

* ci: refactor naming

* ci: fix zizmore findings

* ci: more name refactoring

* ci: less emoji is sometimes better

* ci: more name juggling

* ci: silence step-security warning

* ci: get rid of defaults

* ci: disable errors for lychee

* ci: remove xwin cache

* ci: don't use bash-isms to convert to lowercase

* ci: make sure we do interpolation

* ci: heredoc syntax "<<<" also seems to be a bash-ism

---------

Signed-off-by: Ron <45816308+rjaegers@users.noreply.github.com>

Author: rjaegers

…er/cpp/devcontainer-metadata-vscode.json …container/cpp/devcontainer-metadata.json.devcontainer/cpp/devcontainer-metadata-vscode.json renamed to .devcontainer/cpp/devcontainer-metadata.json .devcontainer/cpp/devcontainer-metadata-vscode.json renamed to .devcontainer/cpp/devcontainer-metadata.json

@@ -0,0 +1,13 @@
+---
+applyTo: ".github/workflows/*.yml"
+---
+
+# GitHub Workflows Guidelines
+
+When writing GitHub Action workflows, ensure that:
+
+- Workflows that have a workflow_call trigger have their filename prefixed with `wc-`.
+- For all re-usable workflows, only the top-level workflow (workflows that are not called themselves by other workflows with workflow_call) has defaults and descriptions for inputs to avoid duplication.
+- All workflows and action definitions have a name that is descriptive and concise, using emoji where appropriate.
+- The sorting order for inputs, secrets, and outputs is alphabetical.
+- The sorting order of other keys is consistent across the repository.

…r/rust/devcontainer-metadata-vscode.json …ontainer/rust/devcontainer-metadata.json.devcontainer/rust/devcontainer-metadata-vscode.json renamed to .devcontainer/rust/devcontainer-metadata.json .devcontainer/rust/devcontainer-metadata-vscode.json renamed to .devcontainer/rust/devcontainer-metadata.json

@@ -1,5 +1,5 @@
 ---
-name: Continuous Integration
+name: CI
 
 on:
   merge_group:
@@ -14,6 +14,10 @@ permissions: {}
 
 jobs:
   build-push-test:
+    name: 🛠️ Build → Push → Test (🍨 ${{ matrix.flavor }})
+    strategy:
+      matrix:
+        flavor: [cpp, rust]
     uses: ./.github/workflows/wc-build-push-test.yml
     secrets:
       TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
@@ -28,3 +32,45 @@ jobs:
       id-token: write
       packages: write
       pull-requests: write
+    with:
+      devcontainer-metadata-file: .devcontainer/${{ matrix.flavor }}/devcontainer-metadata.json
+      dockerfile: .devcontainer/${{ matrix.flavor }}/Dockerfile
+      image-name: ${{ github.repository }}-${{ matrix.flavor }}
+      integration-test-file: test/${{ matrix.flavor }}/integration-tests.bats
+      acceptance-test-path: ${{ matrix.flavor == 'cpp' && 'test/cpp/features' || '' }}
+      test-devcontainer-file: ${{ matrix.flavor == 'cpp' && '.devcontainer/cpp-test/devcontainer.json' || '' }}
+
+  dependency-review:
+    name: 🔍 Dependency Review
+    needs: build-push-test
+    uses: ./.github/workflows/wc-dependency-review.yml
+    permissions:
+      contents: read
+      pull-requests: write
+
+  publish-test-results:
+    name: 📊 Publish Test Results
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+    needs: build-push-test
+    if: ${{ !cancelled() }}
+    steps:
+      - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          merge-multiple: true
+          pattern: test-results-*
+      - uses: EnricoMi/publish-unit-test-result-action@3a74b2957438d0b6e2e61d67b05318aa25c9e6c6 # v2.20.0
+        with:
+          files: test-report-*.xml
+
+  generate-documents:
+    name: 📄 Documentation
+    uses: ./.github/workflows/wc-document-generation.yml
+    permissions:
+      contents: read

.github/instructions/workflows.instructions.md

@@ -9,7 +9,8 @@ on:
 permissions: {}
 
 jobs:
-  delete-images:
+  cleanup-images:
+    name: 🧹 Clean Images
     runs-on: ubuntu-latest
     permissions:
       # dataaxiom/ghcr-cleanup-action needs packages write permission
@@ -19,7 +20,6 @@ jobs:
       - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           disable-sudo: true
-          egress-policy: block
           allowed-endpoints: >
             api.github.com:443
             ghcr.io:443

.github/workflows/continuous-integration.yml

@@ -9,6 +9,7 @@ permissions: {}
 
 jobs:
   close-issues:
+    name: ♻️ Close Stale Issues & PRs
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/image-cleanup.yml

@@ -19,6 +19,7 @@ permissions:
 
 jobs:
   linter:
+    name: 🧹 Lint & Format
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/issue-cleanup.yml

@@ -13,6 +13,7 @@ permissions: read-all
 
 jobs:
   ossf-scorecard:
+    name: 🛡️ OpenSSF Scorecard
     runs-on: ubuntu-latest
     permissions:
       security-events: write

.github/workflows/linting-formatting.yml

@@ -12,14 +12,14 @@ permissions: {}
 
 jobs:
   validate-pr-title:
+    name: ✅ Validate PR Title
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
     steps:
       - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           disable-sudo-and-containers: true
-          egress-policy: block
           allowed-endpoints: >
             api.github.com:443
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
@@ -33,7 +33,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
-        if: always() && steps.pr-title.outputs.error_message != null
+        if: ${{ !cancelled() && steps.pr-title.outputs.error_message != null }}
         with:
           header: pr-title-lint-error
           message: |

.github/workflows/ossf-scorecard.yml

@@ -9,6 +9,7 @@ permissions: {}
 
 jobs:
   delete-images:
+    name: 🗑️ Delete PR Images
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -22,6 +23,7 @@ jobs:
           delete-tags: pr-${{ github.event.pull_request.number }}
           packages: amp-devcontainer,amp-devcontainer-cpp,amp-devcontainer-rust
   cleanup-cache:
+    name: 🧹 Cleanup Cache
     runs-on: ubuntu-latest
     permissions:
       # actions: write permission is required to delete the cache